You finally decided to switch password managers. Maybe your current one raised prices, got acquired, suffered a breach, or simply stopped fitting how you work. Then you open the export screen and realize the stakes: everything you own online is about to travel through a plaintext file. One careless step, and the file that unlocks your bank, your email, and your company's admin panels ends up sitting in your Downloads folder or, worse, synced to a cloud drive you forgot about.
Here's a fact that should make you pause: nearly every password manager exports your vault as an unencrypted CSV file. Not encrypted, not password-protected, just readable text. If someone opens it in Notepad, they see your Netflix password next to your bank login. And passkeys make it messier, because unlike passwords, most passkeys cannot be exported at all yet. They're bound to devices and platforms in ways that resist simple copy-paste migration.
This guide walks you through how to migrate passwords and passkeys between managers without leaking a single credential. You'll learn the exact order of operations, how to handle the passkey problem honestly, how three popular migration paths compare, and a worked example using a realistic 200-item vault.
Key Takeaways
- Password exports are almost always plaintext CSV. Treat that file like cash: create it late, encrypt it, delete it immediately after import.
- Passkeys generally cannot be exported today. Plan to re-register them on each site rather than transfer them.
- Migrate on a trusted local machine with an encrypted disk, never over shared or public networks.
- Do the import, verify a sample of 10 to 15 critical logins, then rotate high-value passwords after the switch.
- Keep the old vault active for 30 days as a fallback before you fully delete it.
- Turn on 2FA and a strong master password in the new manager before you import anything.
Why Migrating Passwords and Passkeys Is Riskier Than It Looks
The danger in a migration isn't the switch itself. It's the brief window where your credentials leave the safety of an encrypted vault and exist as plain data. That window is short but sharp.
Three things make this genuinely risky:
- The export file is plaintext. A CSV from Bitwarden, LastPass, 1Password, or Chrome is human-readable. Backup software, cloud sync, and antivirus tools may quietly copy it before you delete it.
- Clipboard and temp files leak. Some import tools stage data in temporary directories. Clipboard managers can capture passwords you paste during setup.
- Passkeys don't move. A passkey is a cryptographic key pair, and the private half is designed to never leave its secure enclave. There's no clean "export passkeys" button on most platforms in 2024.
If you're moving to a manager you host yourself, the surface area grows further because you also control the server. We covered that specific path in depth in our guide on how to safely migrate to a self-hosted password manager, and it pairs well with everything here.
Passwords vs Passkeys: What Actually Transfers
Before you touch an export button, understand what you're actually able to move. Passwords are portable data. Passkeys are not, at least not the way passwords are.
Passwords
A password is a string. It exports, imports, and re-imports cleanly. Migration is mostly about handling the file safely and mapping fields correctly (username, URL, notes, TOTP seeds).
Passkeys
A passkey is a public/private key pair created per site. The private key lives in a secure element on your phone, laptop, or hardware key. Because it's non-exportable by design, you generally cannot carry passkeys from one manager to another. The FIDO Alliance is building a Credential Exchange Protocol to change this, but broad support isn't here yet.
What this means in practice: for passkeys, you don't migrate, you re-enroll. You log into each site with your existing method, delete the old passkey, and register a new one stored in your destination manager. It's manual, but for most people that's only 5 to 15 sites.
How to Migrate Passwords Safely, Step by Step
This is the core walkthrough. Follow it in order. The sequencing matters more than any single step, because it minimizes how long your data sits exposed.
- Prepare the destination first. Create your new account, set a strong master password (16+ characters, unique), and enable two-factor authentication. Never import into an unsecured vault.
- Verify your device is trusted. Use your own machine with full-disk encryption on (BitLocker on Windows, FileVault on macOS). Disconnect from public Wi-Fi. Close cloud-sync clients like Dropbox or OneDrive temporarily.
- Pause clipboard and backup tools. Quit clipboard managers and pause any real-time backup that could snapshot your Downloads folder. This closes the two most common leak paths.
- Export from the old manager. Choose CSV or the vendor's JSON format. Save it to a folder you'll remember, ideally an encrypted container or a temporary encrypted volume rather than the default Downloads directory.
- Inspect the file (briefly). Open it once to confirm field mapping looks right (URL, username, password, notes). Close it immediately. Don't leave it open in a text editor.
- Import into the new manager. Use the built-in importer and select the matching source format. Most tools have presets for LastPass, Bitwarden, 1Password, Chrome, and generic CSV.
- Securely delete the export file. Don't just move it to Trash. Use a secure-delete utility so the plaintext can't be recovered. On Windows, a purpose-built desktop tool makes this reliable.
- Empty temp folders and clear clipboard. Clear your clipboard history and check temp directories for stray copies the importer may have left.
- Verify a sample. Log into 10 to 15 of your most critical accounts using the new manager to confirm entries imported correctly.
- Rotate high-value passwords. Because those passwords briefly existed in plaintext, change the passwords for your email, bank, and primary work accounts. This is the single best hygiene step post-migration.
If you want a reliable way to overwrite that export file so it's genuinely unrecoverable, a focused utility like the ones in our desktop utilities collection is worth having on hand. For quickly handling and sanitizing sensitive text snippets during setup, some readers keep a secure paste tool such as LionPaste in their kit.
A Worked Example: Migrating a 200-Item Vault
Say you're moving from LastPass to a new manager. Your vault has 200 items: 180 passwords, 12 secure notes, and 8 passkeys. Here's how the numbers actually play out.
Passwords and notes (192 items): These export in one CSV. Import takes about 90 seconds. Field mapping is clean for 185 items; 7 have URLs in the notes field instead of the URL field, so you fix those by hand. Total effort: about 20 minutes including verification.
Passkeys (8 items): These don't export. You visit each of the 8 sites, sign in with your existing credential, remove the old passkey under account security settings, and create a fresh passkey saved in the new manager. Each takes 2 to 4 minutes. Total: roughly 25 minutes.
The exposure window: Your plaintext CSV existed on disk for about 22 minutes. Because you saved it in an encrypted volume and securely wiped it after, that window carried near-zero real risk. Compare that to the common mistake: leaving the file in Downloads for weeks while it silently syncs to three cloud services.
Post-migration rotation: You rotate 6 critical passwords (email, two banks, work SSO, domain registrar, and your cloud host). That's another 15 minutes. Grand total for a clean, safe migration: about an hour.
Comparing Migration Approaches: CSV vs JSON vs Direct Import
Not all migration paths carry the same risk or fidelity. Here's how the three common approaches stack up.
| Approach | Data fidelity | Exposure risk | Handles TOTP seeds | Ease |
|---|---|---|---|---|
| Plaintext CSV export/import | Good for basics, weak for structured fields | High (readable file on disk) | Sometimes | Very easy |
| Vendor JSON export/import | Excellent, preserves folders and custom fields | High (still plaintext) | Usually | Easy |
| Built-in "direct" migration tool | Very good, mapped automatically | Lower (may avoid disk file) | Often | Easiest when available |
The takeaway: if your destination manager offers a native direct importer for your source, use it, because it can avoid writing a plaintext file to disk entirely. If not, JSON preserves more structure than CSV, but both leave a readable file you must securely delete.
Securing Your Environment Before You Start
A migration is only as safe as the machine you run it on. If your computer already harbors a rogue browser extension or a background process quietly reading files, no amount of careful sequencing will save you.
Two quick checks pay off:
- Audit browser extensions. Extensions with broad permissions can read page content and clipboard data. Our walkthrough on how to detect and remove silently installed browser extensions shows exactly how to find the ones you never approved.
- Confirm any new tools are legitimate. If you're installing a fresh utility to help with the migration, vet it first. Our guide on how to vet AI-generated desktop apps before you install them is a good sanity check.
If you run WordPress sites, your saved admin credentials are exactly the kind of high-value target attackers hunt for. Hardening the site itself matters as much as protecting the vault. Tools like eDarpan WordPress Protection and SiteGuard Pro reduce the odds that a leaked admin password becomes a full takeover, and
Cover image: Innovate Maryland Emerging Technology Center by MDGovpics, licensed under BY 2.0 via Openverse.
